[Verse 1]
Control objective sets the goal we need
The outcome that our safeguards must achieve
While control activity's the deed
The specific action that we believe
Will make our systems strong and secure
Design effectiveness makes us sure
[Chorus]
Eight key terms to memorize
O-A-E-O for the first four tries
Objective, Activity, Evidence, Owner too
Operating, Design effectiveness in view
Deficiency, Material weakness at the end
These controls will be your friend
[Verse 2]
Control evidence shows the proof we need
Screenshots, logs, and forms that are signed
System reports that help us read
If our controls worked as designed
The control owner takes the blame
Accountable for the whole control game
[Chorus]
Eight key terms to memorize
O-A-E-O for the first four tries
Objective, Activity, Evidence, Owner too
Operating, Design effectiveness in view
Deficiency, Material weakness at the end
These controls will be your friend
[Bridge]
Operating effectiveness shows it ran
Throughout the period as we planned
Design effectiveness proves the plan
Would work if executed by skilled hands
When controls fail, deficiency's the name
Material weakness brings audit shame
[Verse 3]
SOC Two, CMMC, HIPAA too
ISO standards, PIPEDA's view
These frameworks all depend on you
Understanding what controls can do
From objective down to weakness found
Keep these eight terms safe and sound
[Chorus]
Eight key terms to memorize
O-A-E-O for the first four tries
Objective, Activity, Evidence, Owner too
Operating, Design effectiveness in view
Deficiency, Material weakness at the end
These controls will be your friend
[Outro]
Compliance professionals need to know
How control environments grow
Security practitioners understand
These terms will help you take command